AquaMend: Minimal Re-probing and Conditional Rollback for Latent-Belief Failures in Embodied Agents

1 Introduction

• Embodied agents' latent beliefs can become invalid through physical changes or sensing errors, so correct execution of a stored belief does not ensure a correct action.Undoing or repeating actions alone does not establish whether the supporting belief remains valid.Source: §1 · p. 1
• 21.6% lower mean complete loss than restart and 1.05% lower mean complete loss than DTT across 32 paired simulation scenarios; the DTT difference was not significant after Holm correction.Figure 1 reports both comparisons and points to Table 6 for the result.Source: Figure 1 · p. 2
• AquaMend places probes, latent beliefs, and actions in one recovery dependency graph, comparing re-probing with admissible terminal recovery decisions under expected loss.The objective covers sensing, executed physical recovery, and genuine failures left uncorrected.Source: §1 · p. 2
• Under independence, sensing, and separability assumptions, the per-belief optimum chooses among keeping, rolling back, or re-probing.The closed-form threshold applies in this structured regime.Source: Figure 1 · p. 2, §1 · p. 3
• For correlated failures, shared recovery costs, or partially resolving probes, the joint-posterior policy is myopic and has no global optimality or approximation-ratio guarantee.Evaluation includes paired pouring simulations, causal-granularity and computation assessments, plus separate small-graph and posterior-sensitivity studies.Source: §1 · p. 3

2 Preliminaries

• The recovery dependency graph is a directed acyclic graph with probe, latent-belief, and action nodes linked by measurement support, derived support, belief-to-action dependence, and action dependencies.A probe can re-support a belief rather than require downstream rollback.Source: §2 · p. 3
• For a suspected belief, its downstream set contains executed actions reachable from it, and its rollback cost charges recovery operations for that set.An executed irreversible action makes that rollback infeasible; re-probing can rule out a false alarm, while correction requiring irreversible undo must escalate.Source: §2 · p. 3
• A belief requires correction when it exceeds task error tolerances or its continued use can alter a downstream decision; sensor error can cause such failure without physical change.A false alarm need not indicate a task-relevant failure.Source: §2 · pp. 3–4
• The model's posterior failure probability estimates whether a belief requires task correction, but the proposition-specific probabilities do not measure task success or guarantee usable supporting evidence.The online policy uses a frozen finite joint model of physical changes and persistent sensing errors, updating its posterior from public evidence.Source: §2 · p. 4
• The recovery objective minimizes expected sensing, physical recovery, and residual penalties for genuine failures left uncorrected, while enforcing feasibility restrictions separately.Sensing cost counts executed sensing events, including repetitions; physical cost covers rollback and continuation, and operations are not charged again when shared.Source: §2 · p. 4

3.1 Joint recovery algorithm

• The joint recovery algorithm selects a re-probe with the largest positive one-step expected benefit, or otherwise commits to the best admissible terminal decision.The comparison uses the joint posterior and expected remaining loss.Source: §3.1 · p. 4

3.2 Structured regime: a per-belief three-way threshold

• With independent failures, separable additive rollback costs, and fully resolving probes, Proposition 1 gives a per-belief keep/rollback/re-probe optimum; re-probe when r_i < (1 − q_i)B_i.The threshold compares probe cost with the expected rollback cost avoided.Source: §3.2 · p. 6

3.3 General regime: a myopic adaptive policy

• In the general regime, the joint-posterior policy weighs one-step re-probes against admissible terminal decisions using remaining sensing, recovery, continuation, and residual-failure loss, without global guarantees.The authors claim neither global optimality nor an approximation-ratio guarantee.Source: §3.1 · p. 4, §3.3 · pp. 6–7

3.4 Re-probing as two substeps

• Conditional detection-power screening retains power-per-cost maximizers and probes needed for re-estimation or evidence-source replacement when coverage holds; otherwise, it retains all candidates.Detection tests the fixed pre-probe declaration, while re-estimation checks support for the refreshed declaration.Source: §3.4 · p. 7

4.1 Platforms and data

• The execution-level study uses a time-stepped multi-cup pouring simulation with controlled perturbations before continued execution or stopping.The 32 paired scenarios span four perturbation families and early and late stages, with four independent scenario seeds per combination.Source: §4.1 · p. 7, §4.2 · p. 8

4.3 Metrics

• Complete success requires physical completion, valid belief support, and compliance with quality and budget constraints; complete loss includes physical costs and genuine uncorrected failures.The study also reports probe and rollback counts and costs, decision time, and false-alarm zero-rollback rate.Source: §4.3 · p. 8

4.4 Baselines, ablations, and protocol

• On T4-Stress, AquaMend achieved success 0.976 and mean loss 12.47 across 4,600 paired episodes, with significantly lower losses than decoupled recovery, greedy re-probing, and restart after Holm correction.Depth-2 lookahead matched rounded success and loss, without a significant loss difference.Source: §4.4 · p. 9, Table 5 · p. 9
• AquaMend recovered in 28/32 scenarios and reduced mean complete loss by 21.6% relative to restart; its loss advantage over DTT was not established.The paired loss difference from DTT was not significant after Holm correction.Source: §4.4 · p. 9, Table 6 · p. 10
• Removing re-probing increased mean loss from 5.431 to 38.157 in the earlier discrete T4 ablation, while fine causal graphs lowered loss and rollback count relative to chain graphs.In the separate execution-level study, removing extra re-probing or using a linear-chain control raised mean complete loss, but neither comparison met the Holm-adjusted threshold.Source: §4.4 · p. 10
• Across 4,000 small M1 graphs, AquaMend’s mean expected-risk gap to Exact Adaptive was 0.037, but this finite model establishes no general approximation guarantee.In the M1-Depth diagnostic, AquaMend and depth-2/depth-3 policies incurred risk 4.000 versus 3.750 for Exact Adaptive.Source: §4.4 · p. 10, Table 7 · p. 10
• Online decision time was 2.074 versus 2.364 seconds for the all-candidate ablation, a 12.3% reduction overall, but it increased by 3.4% late when screening lacked coverage.Early-stage time fell by 27.9%.Source: §4.4 · p. 11
• In a separate eight-scenario posterior-sensitivity study, recovery was retained in 7/8 cases under all five posterior settings, but the study is not general robustness evidence.Dispersion and positive failure bias increased mean loss; the 40 executions were not pooled with the main evaluation.Source: §4.4 · p. 11

• Troubleshooting weighs observation against repair, while test sequencing orders diagnostic observations; these strands do not by themselves establish guarantees for AquaMend’s recovery objective.Dependency-based rollback and truth maintenance provide foundations for recovering executed actions and reconsidering unsupported beliefs.Source: §5 · p. 11
• AquaMend combines the observation–repair trade-off with physical measurements supporting latent beliefs and dependencies among executed actions.Re-probing can restore support for a valid belief or provide revised evidence for corrective action; the unified objective includes shared recovery costs once and residual losses for genuine failures left uncorrected.Source: §5 · p. 11

6 Conclusion

• The conclusion reports lower complete loss than restart in simulations, but no established loss advantage over DTT and no physical-robot validation.Screening saves decision time overall but adds overhead in the uncovered late stage.Source: §6 · p. 11

AI use statement

• AI tools assisted with editing, figure layout, consistency checks, literature discovery, theoretical-claim auditing, and interpretation of author-supplied results; the authors retain responsibility for the manuscript.Source: AI use statement · p. 12

Reproducibility statement

• Exact computational reproduction requires the frozen implementation and underlying execution records.The model, algorithm, and evaluation protocol are described in Sections 2–4, with benchmark and evaluation details in the appendices.Source: Reproducibility statement · p. 12

A Proof of Proposition 1

• Under belief-local probes, independent failures, disjoint charged recovery operations, and separable terminal decisions, total expected loss decomposes into local choices.A fully resolving probe costs r + q̂ min{B, L̄}; when B ≤ L or keep-and-ignore is inadmissible, probing beats direct rollback exactly when r < (1 − q̂)B.Source: A Proof of Proposition 1 · p. 14
• When B > L and keep-and-ignore is admissible, probing cannot strictly improve on keeping; conditional on rollback, the minimal required downstream closure is optimal under nonnegative additive costs.Equality in the probe-versus-keep comparison is a tie, not a strict preference.Source: A Proof of Proposition 1 · p. 14

B.1 Complexity status

• The cited optimal-decision-tree reduction does not establish NP-hardness of this formulation because it assigns zero cost to hypothesis-specific rollback sets and omits feasible unions charged at ordinary cost.The proof gap also does not establish tractability.Source: §B.1 · p. 15

B.2 Relation to adaptive coverage

• The general one-probe-then-terminal policy stops when no evaluated probe has positive expected net benefit; adaptive-coverage guarantees do not directly apply, and no approximation ratio is claimed.Source: §B.2 · p. 15

B.3 Oracle lower bound and the decoupled upper bound

• The closure oracle is only a lower bound under additional feasibility and optimality conditions; accepting a failure can be cheaper than unconditional rollback when B_i > L_i.Otherwise, it is a clairvoyant reference.Source: §B.3 · p. 15

C Complexity, benchmark generation, and ground-truth protocol

• The structured decisions require O(|Φ−|) scalar comparisons, while general-policy runtime depends on candidate probes, observation branches, posterior updates, terminal decisions, and graph size.The appendix also describes synthetic small-graph generation and ground-truth annotation for the benchmark.Source: C Complexity, benchmark generation,… · p. 16

D Controlled planning-depth diagnostic (M1-Depth)

• The diagnostic enumerated hidden changed-belief realizations across 360 policy evaluations on graphs with three to six candidate beliefs.Four policies were compared: AquaMend Myopic, depth-2 and depth-3 lookahead, and Exact Adaptive; lookahead replans at the same horizon after each real observation.Source: D Controlled planning-depth diagnostic… · p. 17
• For three beliefs, depth-2 lookahead matched Exact Adaptive at expected risk 3.248; for four, depth-3 matched at 3.484 while depth-2 had 3.679.The four-belief evidence chain exceeded depth 2 but fit within depth 3.Source: D Controlled planning-depth diagnostic… · p. 17
• With six beliefs, AquaMend Myopic and depth-2/depth-3 lookahead each had expected risk 4.000, while Exact Adaptive reduced risk to 3.750.Exact Adaptive evaluated the complete evidence chain; finite-depth policies stopped when the chain extended beyond their visible horizon and accepted residual loss.Source: D Controlled planning-depth diagnostic… · p. 17
• With six beliefs, depth-2 lookahead used a median 30.483 ms and 726.8 KiB, versus 54.056 ms and 1487.6 KiB for Exact Adaptive.Complete planning improved risk but required greater computational resources; Exact Adaptive serves as a reference rather than a replacement for the myopic policy.Source: D Controlled planning-depth diagnostic… · p. 17
• M1-Depth assumes exactly one changed belief and independent, fully resolving probes, so its exact-planning result is limited to this verifiable subclass.It is a controlled mechanism diagnostic, not a replacement for standard T4, T4-Stress, or random-DAG M1.Source: D Controlled planning-depth diagnostic… · p. 17

E Physics-grounded diagnostic results

• Attribution macro precision/recall was 0.994/0.952 over labels with nonzero test support, or 0.745/0.714 when unsupported UN-KNOWN was assigned zero.The test split does not establish performance on the unsupported class.Source: E Physics-grounded diagnostic results · p. 18
• All four policies achieved 40/40 T2 pre-commit safety successes, indicating an effective shared safety mechanism but no comparative advantage for AquaMend.Source: E Physics-grounded diagnostic results · p. 18

F Earlier experimental evaluations

• Earlier T4, T4-Stress, MuJoCo, and M1 evaluations remain separate from the completed physical evaluation and Q1 supplement, and were not pooled.Independent verification requires original code and raw records; the retained earlier records were not recomputed.Source: F Earlier experimental evaluations · p. 18

F.1 Standard T4 results

• On standard T4, AquaMend achieved corrected-success 0.999 and expected total loss 6.09, but four policies had identical per-episode outcomes.Fine graphs reduced E[L] from 6.83 to 5.36 and mean rollback count from 1.47 to 0.98; on irreversible episodes, all four policies had Succ = 0.500 and E[L] = 2.73, escalating when correction required undoing an executed irreversible action.Source: §F.1 · p. 19

F.2 Joint recovery under T4-Stress

• On T4-Stress, AquaMend achieved Succ = 0.976 and E[L] = 12.47, significantly lower loss than decoupled recovery, greedy re-probing, and restart after Holm correction.Depth-2 lookahead matched AquaMend to reported precision, with 4,599 ties among 4,600 episodes and pHolm = 0.317; hard rank ties, adversarial evidence conflicts, and shared closures remained failure boundaries.Source: §F.2 · pp. 19–20

F.3 Physics-grounded execution validation

• In 80 MuJoCo T0/T1 episodes, AquaMend and decision-theoretic troubleshooting both completed all episodes; AquaMend’s proxy loss was 2.125 versus 2.325, with paired p = 0.057.AquaMend also reduced mean rollback count from 0.750 to 0.625; the reported result indicates a favorable cost-efficiency trend, not a significant paired loss difference.Source: §F.3 · p. 20

F.4 Exact small-graph validation on M1

• On 4,000 M1 graphs, Exact Adaptive’s expected-risk ordering was best, followed by depth-2 lookahead and AquaMend; the Exact Adaptive–AquaMend gap was 0.037.Exact Adaptive required complete policy-tree optimization, feasible only on small graphs, and the results do not establish equivalence to or superiority over deeper planning.Source: §F.4 · p. 21, Table 13 · p. 21

F.5 Ablation analysis

• Across 6,100 standard-T4 ablation episodes, removing physical re-probing raised E[L] from 5.431 to 38.157 and lowered Succ from 0.901 to 0.213.Changing the detection objective or increasing probe noise also degraded results; posterior proxy, calibration, and Li variants changed little on standard T4.Source: §F.5 · p. 22, Table 14 · p. 22
• On the 1,200 common-cause T4-Stress ablation episodes, Indep, Beam, and Monte Carlo proxies all had Succ = 1.000 and E[L] = 10.247 because proxy changes did not alter selected actions.This supports execution stability on that split, not a performance advantage for any proxy.Source: §F.5 · p. 22

G Completed paired physical evaluation

• The main comparison used the same 32 scene seeds across AquaMend, DTT, no extra re-probe, full restart, and a linear-chain control.The 16 early and 16 late scenes included false alarms, added water, cup swaps, and visual-sensor perturbations; evaluation truth was used for scoring, not supplied to the online policy.Source: G Completed paired physical evaluation · p. 23
• The physical ledger charges sensing, rollback, and continuation from executed receipts, charging shared operations once and retaining failed and partial executions.Residual losses represent specified uncorrected task-relevant declarations and do not price every possible physical task failure; safe stopping is not successful recovery.Source: G Completed paired physical evaluation · p. 23
• AquaMend’s complete-loss reduction versus restart was 21.6%, while its operational-cost savings were 25.6%.Operational savings exclude residual penalties and decision wall time; the control methods that spent less operationally recovered less often and had greater complete loss.Source: G Completed paired physical evaluation · p. 24
• The four paired complete-loss comparisons were against DTT, no extra re-probe, restart, and linear chain; Holm-adjusted p-values were 0.465318, 0.233337, 0.0000809375, and 0.077465, respectively.The independent unit was the scene; success counts were descriptive, without a confirmatory success-rate comparison.Source: G Completed paired physical evaluation · p. 24
• The decision-time comparison uses four complete next_step calls per scene and includes belief refresh, candidate computation, and command construction, but excludes physical execution and file I/O.The reported overall reduction does not imply a physical-execution speedup or uniform real-time performance; raw calls and frozen implementations remain necessary for independent reproduction.Source: G Completed paired physical evaluation · pp. 25–26
• Screening evaluated 48 of 96 enumerated candidates in early AquaMend trajectories, but all 96 in late trajectories where screening was uncovered.The observed reduction does not establish that screening preserves the optimal action outside the tested states.Source: G Completed paired physical evaluation · p. 25, Table 18 · p. 25
• AquaMend and the all-candidate ablation failed on the same four scenes; safe-stop counts were 3 and 3, respectively, versus 8 for no extra re-probe, 3 for restart, and 7 for linear chain.A successful pour did not always mean complete recovery: scene s23 retained incorrect quantity and sensing declarations.Source: G Completed paired physical evaluation · p. 25, Table 19 · p. 26

H Separate Q1 posterior-sensitivity supplement

• The FIT model uses 72 joint configurations associated with 194 records in 11 groups, jointly representing physical changes and persistent sensor errors.Predictions, declaration-invalidity queries, and candidate losses condition on the same evidence history; identifying an unreliable source does not establish that a usable healthy measurement exists.Source: H Separate Q1 posterior-sensitivity… · p. 26
• Eight new scene seeds were run under five fixed settings, applying one posterior perturbation after the common alarm posterior and then ordinary Bayesian updates.The 40 executions were separate from the 160-run batch; zero-probability states remain outside support, so the transformations cannot test missing latent configurations.Source: H Separate Q1 posterior-sensitivity… · p. 26
• Every setting had complete success and pour success of 7/8, while mean residual loss was 10 for all five settings.The table reports results on eight new paired scenes; the residual loss is identical across settings.Source: H Separate Q1 posterior-sensitivity… · p. 26, Table 20 · p. 27
• Positive bias changed costs on q00, q04, and q07 by 1.022, 0.182, and 15.202, respectively; q07 contributed 92.7% of the 16.406 total increase.The q07 increase remains in the analysis.Source: H Separate Q1 posterior-sensitivity… · p. 27
• Q1 intervals are exploratory paired scene-bootstrap intervals with only eight independent scenes, and the authors make no confirmatory sensitivity significance claim or model selection from them.There is one scene per stage–condition cell, so within-cell variance is not meaningfully estimated by stratified resampling.Source: H Separate Q1 posterior-sensitivity… · p. 27
• Tables 21 and 22 report post-hoc Brier scores and ECE for old and current declaration invalidity on 32 main TEST alarm states, not task success or support feasibility.The analysis does not refit or select models using TEST labels; declarations within a scene are not independent samples, and all-negative categories do not establish detection power for absent faults.Source: H Separate Q1 posterior-sensitivity… · p. 27, Table 21 · p. 28, Table 22 · p. 28
• Table 23 reports predicted loss for offline first-command changes, not realized physical loss under counterfactual rollouts.After commands diverge, archived trajectories are not reused; only the separately executed Q1 trajectories support realized sensitivity results.Source: H Separate Q1 posterior-sensitivity… · p. 27, Table 23 · p. 28

I Screening and declaration implementation scope

• Screening applies only at early T1 when coverage criteria hold for every legal candidate; otherwise the full legal set is retained, without a claim of universally safe pruning.Declaration versions and their evidence are refreshed separately, while support availability and task-completion constraints are checked apart from invalidity probabilities.Source: I Screening and declaration… · p. 29